CVE-2024-57878

What it actually does

A zero-length ptrace SETREGSET call for NT_ARM_FPMR leaves the temporary fpmr variable uninitialized, causing an arbitrary kernel stack value (up to 64 bits) to be written into target->thread.uw.fpmr with no write primitive available to the attacker.

Why it matters to the business

Limited risk of small kernel memory disclosure on arm64 systems when unprivileged processes can invoke ptrace; low urgency given EPSS of 0.00183 with minimal trend, absence from KEV, and no ransomware association despite the flaw existing for over 600 days.

How an attack unfolds

An attacker with ptrace capability on a target process issues a SETREGSET syscall using NT_ARM_FPMR with length zero; the kernel writes uninitialized stack contents into the FPMR register field which the attacker can then read back via GETREGSET, exposing a narrow kernel stack slot.

How to fix it

Apply the upstream kernel fix that initializes the temporary fpmr variable before the copy_from_user operation. For the listed chromium-browser packages on Ubuntu 14.04 LTS, upgrade to version 58.0.3029.81-0ubuntu0.14.04.1172.

How to confirm the fix worked

Confirm the patch by reproducing the zero-length SETREGSET test case and verifying that FPMR contents remain unchanged rather than leaking stack data; alternatively validate the running kernel contains the described initialization change.

Typical attack path

1. Obtain ptrace permissions on the target process
2. Invoke ptrace with SETREGSET for NT_ARM_FPMR using a zero-length buffer
3. Subsequently read the FPMR value via GETREGSET to capture the leaked kernel stack data

How to detect it

Inspect auditd or syscall trace logs for ptrace calls targeting NT_ARM_FPMR regset (0x40e) with zero length followed by immediate GETREGSET operations on the same regset.

What your security team should do

• Prioritize kernel updates on arm64 systems that expose ptrace to untrusted processes
• Review and restrict ptrace usage via Yama LSM or seccomp filters where feasible
• Monitor EPSS and KEV updates for any future elevation in exploitability